[SOLVED] NetworkManager doesn't find keyring secrets without nm-applet

wehlutyk · 2019-05-27 09:07:43

Dear all, first of all thanks for the amazing system, wiki, and forums! Been using Arch for a few years and it's been a blast being able to understand what is going on in my system.

My situation

I have Sway (and Gnome shell) installed, I log in to Sway using GDM

gnome-keyring is running after logging in to Sway (I didn't configure that), and my login keyring is successfully unlocked by GDM on login, as I can read the secrets in seahorse. Here is "journalctl -fe" while opening seahorse:

May 27 10:42:54 keon systemd[552]: Started GnuPG cryptographic agent and passphrase cache.
May 27 10:42:54 keon gpg-agent[2437]: gpg-agent (GnuPG) 2.2.15 starting in supervised mode.
May 27 10:42:54 keon gpg-agent[2437]: using fd 3 for ssh socket (/run/user/1000/gnupg/S.gpg-agent.ssh)
May 27 10:42:54 keon gpg-agent[2437]: using fd 4 for browser socket (/run/user/1000/gnupg/S.gpg-agent.browser)
May 27 10:42:54 keon gpg-agent[2437]: using fd 5 for extra socket (/run/user/1000/gnupg/S.gpg-agent.extra)
May 27 10:42:54 keon gpg-agent[2437]: using fd 6 for std socket (/run/user/1000/gnupg/S.gpg-agent)
May 27 10:42:54 keon gpg-agent[2437]: listening on: std=6 extra=5 browser=4 ssh=3

NetworkManager is running after logging in to Sway (I didn't configure that), and I can connect to any wifi whose password is in /etc/NetworkManager/system-connections/

My problem

I want to connect to a WPA2 Enterprise Wifi network (eduroam, PEAP/MSCHAPv2), and the password is stored in Gnome Keyring (login keyring).

Gnome Shell connects automatically to this network after login
If I log in to Gnome, then log out, then log in to Sway, NetworkManager has connected me to eduroam (and has done so since I logged in to Gnome, as I can see it still connected on the GDM login screen).

However if I log in to Sway straight after booting, NetworkManager doesn't find the password ("no secrets: No agents were available for this request.", see logs below). Here is "journalctl -fe" while running "nmcli device wifi connect eduroam" (which answers back "Error: Connection activation failed: (7) Secrets were required, but not provided."):

May 27 10:43:32 keon NetworkManager[443]: <info>  [1558946612.1872] device (wlp58s0): Activation: starting connection 'eduroam' (d48098a9-ce7b-421c-904e-abc14476068e)
May 27 10:43:32 keon NetworkManager[443]: <info>  [1558946612.1874] audit: op="connection-activate" uuid="d48098a9-ce7b-421c-904e-abc14476068e" name="eduroam" pid=2699 uid=1000 result="success"
May 27 10:43:32 keon NetworkManager[443]: <info>  [1558946612.1875] device (wlp58s0): state change: disconnected -> prepare (reason 'none', sys-iface-state: 'managed')
May 27 10:43:32 keon audit[443]: USYS_CONFIG pid=443 uid=0 auid=4294967295 ses=4294967295 msg='op=connection-activate uuid=d48098a9-ce7b-421c-904e-abc14476068e name="eduroam" pid=2699 uid=1000 result=success exe="/usr/bin/NetworkManager" hostname=? addr=? terminal=? res=success'
May 27 10:43:32 keon NetworkManager[443]: <info>  [1558946612.1910] device (wlp58s0): set-hw-addr: reset MAC address to 9C:B6:D0:F2:7D:2F (preserve)
May 27 10:43:32 keon kernel: audit: type=1111 audit(1558946612.182:56): pid=443 uid=0 auid=4294967295 ses=4294967295 msg='op=connection-activate uuid=d48098a9-ce7b-421c-904e-abc14476068e name="eduroam" pid=2699 uid=1000 result=success exe="/usr/bin/NetworkManager" hostname=? addr=? terminal=? res=success'
May 27 10:43:32 keon NetworkManager[443]: <info>  [1558946612.2020] device (wlp58s0): supplicant interface state: inactive -> disabled
May 27 10:43:32 keon NetworkManager[443]: <info>  [1558946612.2020] device (p2p-dev-wlp58s0): supplicant management interface state: inactive -> disabled
May 27 10:43:32 keon NetworkManager[443]: <info>  [1558946612.2021] device (wlp58s0): state change: prepare -> config (reason 'none', sys-iface-state: 'managed')
May 27 10:43:32 keon NetworkManager[443]: <info>  [1558946612.2023] device (wlp58s0): Activation: (wifi) access point 'eduroam' has security, but secrets are required.
May 27 10:43:32 keon NetworkManager[443]: <info>  [1558946612.2023] device (wlp58s0): state change: config -> need-auth (reason 'none', sys-iface-state: 'managed')
May 27 10:43:32 keon NetworkManager[443]: <warn>  [1558946612.2036] device (wlp58s0): no secrets: No agents were available for this request.
May 27 10:43:32 keon NetworkManager[443]: <info>  [1558946612.2036] device (wlp58s0): state change: need-auth -> failed (reason 'no-secrets', sys-iface-state: 'managed')
May 27 10:43:32 keon NetworkManager[443]: <warn>  [1558946612.2040] device (wlp58s0): Activation: failed for connection 'eduroam'
May 27 10:43:32 keon NetworkManager[443]: <info>  [1558946612.2042] device (wlp58s0): state change: failed -> disconnected (reason 'none', sys-iface-state: 'managed')
May 27 10:43:32 keon NetworkManager[443]: <info>  [1558946612.2052] device (wlp58s0): set-hw-addr: set MAC address to 9E:C7:6B:27:E5:26 (scanning)
May 27 10:43:32 keon kernel: IPv6: ADDRCONF(NETDEV_UP): wlp58s0: link is not ready
May 27 10:43:32 keon kernel: IPv6: ADDRCONF(NETDEV_UP): wlp58s0: link is not ready
May 27 10:43:32 keon kernel: IPv6: ADDRCONF(NETDEV_UP): wlp58s0: link is not ready
May 27 10:43:32 keon NetworkManager[443]: <info>  [1558946612.4191] device (wlp58s0): supplicant interface state: disabled -> inactive
May 27 10:43:32 keon NetworkManager[443]: <info>  [1558946612.4197] device (p2p-dev-wlp58s0): supplicant management interface state: disabled -> inactive
May 27 10:43:32 keon wpa_supplicant[519]: wlp58s0: Reject scan trigger since one is already pending

But (still logging in to Sway straight after booting), if I start nm-applet on the command line (which gives no cli output and shows no tray icon), NetworkManager suddenly connects to eduroam. Again "journalctl -fe" while running "nm-applet":

May 27 10:43:52 keon NetworkManager[443]: <info>  [1558946632.9686] agent-manager: req[0x5626271add40, :1.330/org.freedesktop.nm-applet/1000]: agent registered
May 27 10:43:52 keon NetworkManager[443]: <info>  [1558946632.9688] policy: auto-activating connection 'eduroam' (d48098a9-ce7b-421c-904e-abc14476068e)
May 27 10:43:52 keon NetworkManager[443]: <info>  [1558946632.9696] device (wlp58s0): Activation: starting connection 'eduroam' (d48098a9-ce7b-421c-904e-abc14476068e)
May 27 10:43:52 keon NetworkManager[443]: <info>  [1558946632.9697] device (wlp58s0): state change: disconnected -> prepare (reason 'none', sys-iface-state: 'managed')
May 27 10:43:52 keon NetworkManager[443]: <info>  [1558946632.9737] device (wlp58s0): set-hw-addr: reset MAC address to 9C:B6:D0:F2:7D:2F (preserve)
May 27 10:43:52 keon NetworkManager[443]: <info>  [1558946632.9825] device (wlp58s0): state change: prepare -> config (reason 'none', sys-iface-state: 'managed')
May 27 10:43:52 keon NetworkManager[443]: <info>  [1558946632.9828] device (wlp58s0): Activation: (wifi) access point 'eduroam' has security, but secrets are required.
May 27 10:43:52 keon NetworkManager[443]: <info>  [1558946632.9829] device (wlp58s0): state change: config -> need-auth (reason 'none', sys-iface-state: 'managed')
May 27 10:43:52 keon kernel: IPv6: ADDRCONF(NETDEV_UP): wlp58s0: link is not ready
May 27 10:43:53 keon NetworkManager[443]: <info>  [1558946633.0023] device (wlp58s0): state change: need-auth -> prepare (reason 'none', sys-iface-state: 'managed')
May 27 10:43:53 keon NetworkManager[443]: <info>  [1558946633.0026] device (wlp58s0): state change: prepare -> config (reason 'none', sys-iface-state: 'managed')
May 27 10:43:53 keon NetworkManager[443]: <info>  [1558946633.0028] device (wlp58s0): Activation: (wifi) connection 'eduroam' has security, and secrets exist.  No new secrets needed.
May 27 10:43:53 keon NetworkManager[443]: <info>  [1558946633.0029] Config: added 'ssid' value 'eduroam'
May 27 10:43:53 keon NetworkManager[443]: <info>  [1558946633.0029] Config: added 'scan_ssid' value '1'
May 27 10:43:53 keon NetworkManager[443]: <info>  [1558946633.0029] Config: added 'bgscan' value 'simple:30:-65:300'
May 27 10:43:53 keon NetworkManager[443]: <info>  [1558946633.0029] Config: added 'key_mgmt' value 'WPA-EAP WPA-EAP-SHA256'
May 27 10:43:53 keon NetworkManager[443]: <info>  [1558946633.0029] Config: added 'password' value '<hidden>'
May 27 10:43:53 keon NetworkManager[443]: <info>  [1558946633.0029] Config: added 'eap' value 'PEAP'
May 27 10:43:53 keon NetworkManager[443]: <info>  [1558946633.0029] Config: added 'fragment_size' value '1266'
May 27 10:43:53 keon NetworkManager[443]: <info>  [1558946633.0029] Config: added 'phase2' value 'auth=MSCHAPV2'
May 27 10:43:53 keon NetworkManager[443]: <info>  [1558946633.0029] Config: added 'ca_cert' value '/home/sl/.cat_installer/ca.pem'
May 27 10:43:53 keon NetworkManager[443]: <info>  [1558946633.0030] Config: added 'identity' value 'slerique@ens-lyon.fr'
May 27 10:43:53 keon NetworkManager[443]: <info>  [1558946633.0030] Config: added 'proactive_key_caching' value '1'
May 27 10:43:53 keon NetworkManager[443]: <info>  [1558946633.1183] device (wlp58s0): supplicant interface state: inactive -> disconnected
May 27 10:43:53 keon NetworkManager[443]: <info>  [1558946633.1184] device (p2p-dev-wlp58s0): supplicant management interface state: inactive -> disconnected
May 27 10:43:53 keon NetworkManager[443]: <info>  [1558946633.1223] device (wlp58s0): supplicant interface state: disconnected -> inactive
May 27 10:43:53 keon NetworkManager[443]: <info>  [1558946633.1225] device (p2p-dev-wlp58s0): supplicant management interface state: disconnected -> inactive
May 27 10:43:53 keon NetworkManager[443]: <info>  [1558946633.1295] device (wlp58s0): supplicant interface state: inactive -> scanning
May 27 10:43:53 keon NetworkManager[443]: <info>  [1558946633.1296] device (p2p-dev-wlp58s0): supplicant management interface state: inactive -> scanning
May 27 10:43:53 keon wpa_supplicant[519]: wlp58s0: CTRL-EVENT-REGDOM-CHANGE init=BEACON_HINT type=UNKNOWN
May 27 10:43:57 keon wpa_supplicant[519]: wlp58s0: SME: Trying to authenticate with 00:9e:1e:05:db:40 (SSID='eduroam' freq=5660 MHz)
May 27 10:43:57 keon kernel: wlp58s0: authenticate with 00:9e:1e:05:db:40
May 27 10:43:58 keon NetworkManager[443]: <info>  [1558946638.0214] device (wlp58s0): supplicant interface state: scanning -> authenticating
May 27 10:43:58 keon NetworkManager[443]: <info>  [1558946638.0214] device (p2p-dev-wlp58s0): supplicant management interface state: scanning -> authenticating
May 27 10:43:58 keon wpa_supplicant[519]: wlp58s0: Trying to associate with 00:9e:1e:05:db:40 (SSID='eduroam' freq=5660 MHz)
May 27 10:43:58 keon kernel: wlp58s0: send auth to 00:9e:1e:05:db:40 (try 1/3)
May 27 10:43:58 keon kernel: wlp58s0: authenticated

So my question: under Sway, why doesn't NetworkManager find the keyring secrets without using nm-applet? (and how can I diagnose more?)

I have tried

Everything (or so I think) listed on the GNOME/Keyring and NetworkManager wiki pages.
Searching the Web, and found no similar problem online
Searching the forum for "networkmanager + keyring", again to no avil

More info

I set SSH_AUTH_SOCK for cli apps in my oh-my-fish config (.config/omf/init.fish):

if [ -n "$DESKTOP_SESSION" ];
    eval (gnome-keyring-daemon --start | sed 's/\(.*\)=\(.*\)/set -gx \1 \2;/')
end

I set SSH_AUTH_SOCK for all apps in .config/environment.d/envvars.conf:
```
SSH_AUTH_SOCK="/run/user/1000/keyring/ssh"
```
My understanding is that anyway this shouldn't matter, as NetworkManager communicates with libsecrets through D-Bus

Here is /etc/NetworkManager/system-connections/eduroam:

[connection]
id=eduroam
uuid=d48098a9-ce7b-421c-904e-abc14476068e
type=wifi
permissions=
timestamp=1558728783

[wifi]
mac-address=9C:B6:D0:F2:7D:2F
mac-address-blacklist=
mode=infrastructure
seen-bssids=<long list of MAC addresses>
ssid=eduroam

[wifi-security]
key-mgmt=wpa-eap

[802-1x]
ca-cert=/home/sl/.cat_installer/ca.pem
eap=peap;
identity=<my university email>
password-flags=1
phase2-auth=mschapv2

[ipv4]
dns-search=
method=auto

[ipv6]
addr-gen-mode=stable-privacy
dns-search=
ip6-privacy=0
method=auto

Thank you for any help!

Last edited by wehlutyk (2019-05-27 13:10:11)

V1del · 2019-05-27 10:50:38

Welcome to the boards, excellent first post, shows some good research.

wehlutyk wrote:

My understanding is that anyway this shouldn't matter, as NetworkManager communicates with libsecrets through D-Bus

nm-applet is what links to libsecret, everything works as supposed to here. I don't think this is simply something you can configure away, apart from setting up as a system-connection

FWIW I'd configure some sway autostart to start up nm-applet so that this relation is established

Last edited by V1del (2019-05-27 10:56:00)

wehlutyk · 2019-05-27 10:58:46

Thanks for the quick reply and the kind words

Makes sense. So how would I go about connecting in the terminal only (and using the gnome-keyring secret)? nmcli and nmtui don't see the keyring either, and having to start nm-applet seems a bit off if I want to stay terminal-based (say I'm without graphical interface).

wehlutyk · 2019-05-27 11:04:22

I forgot to mention that nm-connection-editor also doesn't find the secrets: when I edit the eduroam configuration, the password field is blank (not the case in Gnome) -- meaning I have to reenter it if I want to change something.

V1del · 2019-05-27 11:22:39

nm-applet has to be started, all the other tools do not know about gnome-keyring, or find out what it is that gnome-shell starts up, might be some simple DBUS daemon. I don't use gnome so I can't be of much more help here, FWIW it works the same on KDE, it's kwallet keyring is only directly supported by the KDE provided plasma-nm, which has to be started as well.

wehlutyk · 2019-05-27 13:08:50

I see — I hadn't imagined running nm-applet would affect the cli interfaces' ability to read/edit the keyring. I feel this could be worth emphasizing in the NetworkManager wiki page → see Talk:NetworkManager#Explain that encrypting passwords requires nm-applet (or equivalent?) to be running.

Marking as solved then. Thanks again!

Arch Linux

#1 2019-05-27 09:07:43

[SOLVED] NetworkManager doesn't find keyring secrets without nm-applet

#2 2019-05-27 10:50:38

Re: [SOLVED] NetworkManager doesn't find keyring secrets without nm-applet

#3 2019-05-27 10:58:46

Re: [SOLVED] NetworkManager doesn't find keyring secrets without nm-applet

#4 2019-05-27 11:04:22

Re: [SOLVED] NetworkManager doesn't find keyring secrets without nm-applet

#5 2019-05-27 11:22:39

Re: [SOLVED] NetworkManager doesn't find keyring secrets without nm-applet

#6 2019-05-27 13:08:50

Re: [SOLVED] NetworkManager doesn't find keyring secrets without nm-applet

Board footer